{% extends "base.html" %}
{% block content %}
<div class="login-wrapper">
  <div class="deploy-card">
    <h1>{{ gettext("Authorize %(client)s", client=client_name) }}</h1>
    {% if client_description %}
    <p class="deploy-desc">{{ client_description }}</p>
    {% endif %}
    <p class="deploy-desc">
      <strong>{{ client_name }}</strong>
      {{ gettext("is asking permission to access your account. If you approve, it will receive:") }}
    </p>

    <ul class="consent-scope-list">
      {% for s in scope_descriptions %}
      <li class="consent-scope">
        <div class="consent-scope-label">{{ s.label }}</div>
        <div class="consent-scope-desc">{{ s.description }}</div>
        {% if s.claims %}
        <ul class="consent-claims">
          {% for c in s.claims %}
          <li>
            <span class="claim-key">{{ c.name }}</span>
            <span class="claim-val">{{ c.value }}</span>
          </li>
          {% endfor %}
        </ul>
        {% endif %}
      </li>
      {% endfor %}
    </ul>

    <p class="consent-hint">
      {{ gettext("You can revoke this approval at any time from the Settings page.") }}
    </p>

    <form method="POST" action="{{ authorize_url }}">
      {# Explicit allowlist of the /authorize-resubmission fields.
         Iterating params.items() would silently pass through any
         future server-side addition; this list makes what the form
         actually carries forward auditable from the template alone. #}
      <input type="hidden" name="client_id"             value="{{ params.client_id or '' }}">
      <input type="hidden" name="redirect_uri"          value="{{ params.redirect_uri or '' }}">
      <input type="hidden" name="response_type"         value="{{ params.response_type or '' }}">
      <input type="hidden" name="scope"                 value="{{ params.scope or '' }}">
      <input type="hidden" name="state"                 value="{{ params.state or '' }}">
      <input type="hidden" name="nonce"                 value="{{ params.nonce or '' }}">
      <input type="hidden" name="code_challenge"        value="{{ params.code_challenge or '' }}">
      <input type="hidden" name="code_challenge_method" value="{{ params.code_challenge_method or '' }}">
      <input type="hidden" name="prompt"                value="{{ params.prompt or '' }}">
      <input type="hidden" name="_oidc_consent_nonce"   value="{{ consent_nonce }}">
      <div class="login-buttons mt-18">
        <button type="submit" name="_oidc_consent_grant" value="1"
                class="btn btn-primary">{{ gettext("Allow") }}</button>
        <button type="submit" name="_oidc_consent_deny" value="1"
                class="btn btn-secondary">{{ gettext("Deny") }}</button>
      </div>
    </form>
  </div>
</div>
{% endblock %}